CS0-003 Practice Test 11 — 15 Questions

Question 1

An analyst has several malware samples from the same campaign and wants to detect related files based on unique strings and byte patterns. Which method is MOST appropriate? In the evidence source phase, Which evidence source best supports or refutes the detection?

Accepted Answer

Create and test a YARA rule against known-good and known-bad samples. YARA rules are specifically designed for malware identification and classification by matching patterns (strings, byte sequences, and regular expressions) in files or processes. Creating and testing a YARA rule against known-good and known-bad samples allows the analyst to detect related files from the same campaign with high precision and low false positives, directly addressing the need to find files sharing unique strings and byte patterns.

Answer

Use only a firewall deny rule for port 443

Answer

Create a CVE entry

Answer

Tune DHCP lease duration

Question 2

An EDR alert shows powershell.exe launched by winword.exe with an encoded command line and outbound HTTPS shortly after a user opened an email attachment. What is the BEST first analytic pivot? In the alert triage phase, Which action gives the analyst the clearest next triage step?

Accepted Answer

Decode the command and inspect the process tree, parent document, and network destination. Option B is correct because decoding the encoded PowerShell command reveals the attacker's intent, inspecting the process tree shows the execution chain from winword.exe to powershell.exe, examining the parent document identifies the malicious attachment, and analyzing the network destination uncovers the C2 server. This systematic approach provides the clearest next triage step by correlating the initial infection vector with the subsequent malicious activity, enabling the analyst to contain the threat effectively.

Answer

Disable the SIEM parser for PowerShell events

Answer

Reimage every workstation in the department

Answer

Close the alert because HTTPS is expected traffic

Question 3

An endpoint is actively beaconing to a known malicious IP and spawning credential-dumping tools. The business owner wants evidence preserved. What is the BEST containment action? In the alert triage phase, Which action gives the analyst the clearest next triage step?

Accepted Answer

Network-isolate the endpoint through EDR while preserving disk and memory evidence. Network-isolating the endpoint via EDR preserves volatile memory and disk evidence while stopping the active beaconing and credential dumping. This allows forensic acquisition without the risk of the attacker wiping data or triggering anti-forensic mechanisms, which powering off (Option A) would cause by losing memory evidence. The isolation action provides the clearest next triage step because the analyst can then safely collect a memory dump and disk image for analysis.

Answer

Power off the machine immediately in every case

Answer

Run disk cleanup to remove temporary files

Answer

Allow the host to run until the next maintenance window

Question 4

An endpoint is actively beaconing to a known malicious IP and spawning credential-dumping tools. The business owner wants evidence preserved. What is the BEST containment action? In the root-cause analysis phase, Which finding would most directly explain the activity?

Accepted Answer

Network-isolate the endpoint through EDR while preserving disk and memory evidence. Network-isolating the endpoint through EDR (option B) is the best containment action because it immediately stops the beaconing to the malicious IP and prevents further credential dumping while preserving both disk and memory evidence for forensic analysis. This aligns with incident response best practices where containment must not destroy volatile data (e.g., memory artifacts of running credential-dumping processes) or persistent evidence on disk. EDR isolation typically uses a host-based firewall rule to block all inbound/outbound traffic except to the EDR management channel, ensuring the host is quarantined without powering it off or altering the file system.

Answer

Allow the host to run until the next maintenance window

Answer

Run disk cleanup to remove temporary files

Answer

Power off the machine immediately in every case

Question 5

During a post-compromise review, a developer accidentally committed a cloud access key to a public repository. Logs show the key was used from an unfamiliar IP. What should be done first? During eradication, which decision is most defensible? which action should be prioritized before closure?

Accepted Answer

Disable or rotate the key and review actions performed with it. Option B is correct because the immediate priority is to invalidate the compromised credential (rotate or disable the key) to prevent further unauthorized access, and then review the actions performed with it to assess the scope of the breach. This aligns with the NIST SP 800-61 incident response lifecycle, specifically the containment phase, where stopping the attacker's access is paramount before eradication or closure.

Answer

Wait to see whether charges increase

Answer

Block the developer's laptop from Wi-Fi

Answer

Ask the developer to delete the commit only

Question 6

Which pipeline controls help prevent vulnerable dependencies reaching production? (Choose two.)

Accepted Answer

SBOM generation and review for released builds. A is correct because SBOM (Software Bill of Materials) generation and review provides a detailed inventory of all components in a build, enabling teams to identify and block vulnerable dependencies before release. This aligns with supply chain security best practices, as SBOMs allow automated comparison against vulnerability databases (e.g., NVD) to enforce policy gates early in the pipeline.

Answer

Manual badge checks at the office door

Answer

DNS MX record rotation

Question 7

Which three of the following are common challenges when conducting authenticated vulnerability scans in a large, heterogeneous network? (Choose three.)

Accepted Answer

Elevated risk of account lockouts or service disruption due to incorrect credentials. Correct: Credential management and rotation is a major challenge due to diverse systems and the need for secure storage. Incorrect credentials can cause account lockouts or disrupt services, especially in Active Directory environments. Granting the principle of least privilege to scan accounts is critical but complex across many systems. Incorrect: Bandwidth increase from authenticated scans is usually minimal; the main impact is on the target system's performance. Most modern scanners support authenticated scanning of virtual and cloud assets via APIs or agent-based methods. Authenticated scans greatly improve accuracy but never guarantee 100% detection due to unknown vulnerabilities or configuration nuances.

Answer

Inability to scan virtualized or cloud-based assets using authenticated methods

Answer

Increased network bandwidth consumption due to deeper inspection of system configurations

Answer

Authenticated scans always provide 100% accurate vulnerability detection

Question 8

A scan of Windows servers reports few findings, but the scanner used no credentials. The security manager suspects missing patch data. What should be changed? For control selection, Which control best addresses the stated weakness without hiding risk?

Accepted Answer

Run authenticated scans using least-privilege scanner credentials. Unauthenticated scans only enumerate open ports and services visible without credentials, missing the patch status of installed software because they cannot query the Windows registry or WMI for installed updates. Running authenticated scans with least-privilege credentials allows the scanner to log into each target and retrieve detailed patch data via the Windows Update Agent API or registry keys, revealing missing patches that were previously invisible. This directly addresses the security manager's suspicion of missing patch data without introducing unnecessary risk.

Answer

Increase only the port range

Answer

Disable host firewalls permanently

Answer

Trust the unauthenticated result as complete

Question 9

A business owner accepts delayed remediation for a production system. What must the report include? If the primary audience is legal/privacy stakeholder, which content choice is most appropriate?

Accepted Answer

Risk owner, reason, compensating controls, review date, and expiry. Option C is correct because when a business owner accepts delayed remediation for a production system, the report must formally document the risk acceptance. This includes the risk owner, the reason for accepting the risk, any compensating controls in place, a review date to reassess the risk, and an expiry date for the acceptance. For a legal/privacy stakeholder, this documentation provides an auditable trail that demonstrates due diligence and compliance with regulatory requirements, such as GDPR or HIPAA.

Answer

No mention of the accepted risk

Answer

Only the analyst's personal opinion

Answer

A permanent exception with no review

Question 10

A business owner accepts delayed remediation for a production system. What must the report include? If the primary audience is business service owner, which content choice is most appropriate?

Accepted Answer

Risk owner, reason, compensating controls, review date, and expiry. Option B is correct because when a business owner accepts delayed remediation for a production system, the report must formally document the risk acceptance decision. This includes the risk owner (who accepted the risk), the reason for acceptance, any compensating controls in place, a review date to reassess the risk, and an expiry date for the acceptance. This aligns with risk management frameworks like NIST SP 800-37 and ISO 27005, which require traceability and accountability for accepted risks.

Answer

Only the analyst's personal opinion

Answer

No mention of the accepted risk

Answer

A permanent exception with no review

Question 11

A business unit accepts the risk of delaying a patch because downtime would breach a contractual deadline. What should be updated? For validation, Which action should be taken before closing or downgrading the finding?

Accepted Answer

The risk register with owner, justification, expiry date, and compensating controls. When a business unit formally accepts the risk of delaying a patch due to contractual constraints, the risk must be documented in the risk register. This entry should include the owner, justification, expiry date, and compensating controls to ensure the risk is tracked, reviewed, and eventually remediated. This aligns with the vulnerability management lifecycle, where accepted risks require formal documentation and periodic reassessment.

Answer

The firewall vendor invoice

Answer

The incident containment playbook only

Answer

The phishing training completion list

Question 12

A responder is acquiring evidence from a potentially compromised server. Which actions support forensic integrity? (Choose two.)

Accepted Answer

Calculate and record hashes of acquired images. Calculating and recording hashes (e.g., SHA-256) of acquired disk images ensures data integrity by providing a cryptographic fingerprint that can be used later to verify that the evidence has not been altered. This is a foundational step in forensic acquisition, as any modification to the image will produce a different hash, proving tampering or corruption.

Answer

Disable all logging before acquisition

Answer

Edit suspicious files to see whether malware reacts

Question 13

A CI pipeline blocks a container image because the base layer contains a critical OpenSSL CVE. The application team says the vulnerable binary is not used. What is the BEST next step? For tool configuration, Which scanner or pipeline change most directly improves result quality?

Accepted Answer

Validate exploitability and rebuild from a patched base image where feasible. Option B is correct because the best next step is to validate whether the OpenSSL vulnerability is actually exploitable in the context of the application, and if so, rebuild from a patched base image. This balances security with operational efficiency by not blocking the pipeline unnecessarily for unused binaries, while still ensuring that truly exploitable vulnerabilities are remediated. The question asks for the 'BEST next step' for the team, not the scanner configuration, so validating exploitability before acting is the most appropriate response.

Answer

Ship the image and document nothing

Answer

Only rename the image tag

Answer

Ignore all base-image vulnerabilities

Question 14

A host alert shows certutil.exe downloading a file from an external URL, followed by execution from a user-writable directory. What should the analyst focus on? In the containment trade-off phase, Which response balances containment with evidence preservation?

Accepted Answer

Living-off-the-land binary misuse and the downloaded file's hash, origin, and child process. Option C is correct because certutil.exe is a known living-off-the-land binary (LOLB) that attackers abuse to download payloads, bypassing application whitelisting. The analyst must focus on the downloaded file's hash (for threat intelligence), its origin URL (to assess the C2 infrastructure), and any child processes spawned (to trace the execution chain). In the containment trade-off phase, preserving these artifacts is critical for forensic analysis while isolating the host.

Answer

Ignore it because certutil is signed by Microsoft

Answer

Reinstall the browser used by the user

Answer

Only check whether antivirus signatures are current

Question 15

A development team wants to find vulnerable open-source libraries before deployment. Which control best fits this stage? For stakeholder management, Which documentation or approval is required to keep the programme defensible?

Accepted Answer

Software composition analysis in the CI/CD pipeline. Software composition analysis (SCA) is the correct control because it automatically scans the application's dependencies against known vulnerability databases (e.g., NVD, OSS Index) to identify vulnerable open-source libraries. Integrating SCA into the CI/CD pipeline ensures vulnerabilities are caught before deployment, aligning with the 'shift left' security principle. This is the only option that directly addresses the need to find vulnerable open-source libraries at the build stage.

Answer

Database transaction log backups

Answer

Physical badge access reviews

Answer

Wireless spectrum analysis